From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Julian Wiedmann <jwi@linux.ibm.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 3.18 10/13] s390/qeth: don't dump past end of unknown HW header
Date: Mon, 1 Oct 2018 00:41:51 +0000 [thread overview]
Message-ID: <20181001004139.147341-10-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001004139.147341-1-alexander.levin@microsoft.com>
From: Julian Wiedmann <jwi@linux.ibm.com>
[ Upstream commit 0ac1487c4b2de383b91ecad1be561b8f7a2c15f4 ]
For inbound data with an unsupported HW header format, only dump the
actual HW header. We have no idea how much payload follows it, and what
it contains. Worst case, we dump past the end of the Inbound Buffer and
access whatever is located next in memory.
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
drivers/s390/net/qeth_l2_main.c | 2 +-
drivers/s390/net/qeth_l3_main.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 1405fe4c0c96..da8d94b27ec9 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -452,7 +452,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
default:
dev_kfree_skb_any(skb);
QETH_CARD_TEXT(card, 3, "inbunkno");
- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
continue;
}
work_done++;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 908c294aebae..f3a765655072 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1993,7 +1993,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
default:
dev_kfree_skb_any(skb);
QETH_CARD_TEXT(card, 3, "inbunkno");
- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
continue;
}
work_done++;
--
2.17.1
next prev parent reply other threads:[~2018-10-01 0:42 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-01 0:41 [PATCH AUTOSEL 3.18 01/13] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 02/13] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 03/13] RDMA/ucma: check fd type in ucma_migrate_id() Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 04/13] USB: yurex: Check for truncation in yurex_read() Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 05/13] fs/cifs: suppress a string overflow warning Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 06/13] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 07/13] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 08/13] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 09/13] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01 0:41 ` Sasha Levin [this message]
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 11/13] cifs: read overflow in is_valid_oplock_break() Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 12/13] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 13/13] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001004139.147341-10-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=davem@davemloft.net \
--cc=jwi@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).